Kaspersky Digital Footprint Intelligence has prepared a new report Inside the dark web job market: Their talent, our threat. There was a two-fold increase in the number of résumés and jobs posted on underground forums in Q1 2024 compared to Q1 2023, and this number remained on the same level in Q1 2025.
Overall, in 2025, résumés outnumber vacancies 55% to 45%, driven by global layoffs and an influx of younger candidates. Age distribution among the candidates shows a median seeker age of just 24, with a marked teenager presence.
Jobs found on the dark web are predominantly related to cybercrime or other illegal activities, although some legitimate positions are present as well.
Kaspersky findings show a shadow economy where 69% of job seekers did not specify a preferred field, openly signaling they’d take any paid opportunity – from programming to running scams or high-stakes cyber operations. The most in-demand IT roles posted by employers on the dark web reflect a mature criminal ecosystem:
- Developers (accounted for 17% of vacancies) create attack tools;
- Penetration testers (12%) probe networks for weaknesses;
- Money launderers (11%) clean illicit funds through layered transactions;
- Carders (6%) steal and monetise payment data;
- Traffers (5%) drive victims to phishing sites or infected downloads.
Gender-specific patterns emerged in specialised applications. Female applicants predominantly sought interpersonal roles, including support, call-centre, and technical-assistance positions. Male applicants, by contrast, more frequently targeted technical and financial-crime roles – developers, money mules, or mule handlers.
Salary expectations varied sharply by specialisation. Reverse engineers commanded the highest compensation, averaging over $5,000 monthly, followed by penetration testers at $4,000 monthly and developers at $2,000. Fraudsters tended to receive a fixed percentage of a team’s income. Money launderers average 20%, while carders and traffers earn approximately 30% and 50% of the full income, respectively. These figures reflect a premium on scarce, high-impact skills within the shadow ecosystem.
“The shadow job market is no longer peripheral; it’s absorbing the unemployed, the underage, and the overqualified. Many arrive thinking that the dark web and the legal market are fundamentally alike, rewarding proven skills over diplomas, with the dark web even offering some benefits – like offers landing within 48 hours and no HR interviews. However, not many realise that working on the dark web can lead to prison,” comments Alexandra Fedosimova, Digital Footprint Analyst at Kaspersky.
Young individuals contemplating dark web employment must recognise that short-term earnings carry irreversible legal and reputational consequences. Parents, educators, and the community are urged to report suspicious online solicitations immediately. Children should be shown that there are multiple skill-building and career pathways in legitimate technology sectors, such as cybersecurity.
For example, Kaspersky has a special project What we should do with kids who hack on how teens can be rehabilitated and taught to use their skills for good. Kaspersky’s ‘Cyber Pathways’ project also offers a comprehensive look into the essential cybersecurity roles, skills, and tools, to help newcomers to cybersecurity, IT generalists, and seasoned experts to discover their ideal cybersecurity role.
